Known risks

These are the risks the protocol carries today, at the level of the protocol rather than any one deployment.

FundsCopy Anchor Link

1. The program upgrade authority can replace any program at once, bypassing every timelock, including the keys the pool checks proofs against. See governance and upgrades.
2. A token's issuer keeps its powers. The pool accepts tokens whatever powers their issuers hold. An issuer able to freeze or move its token could freeze or drain the pool's holdings of that token, though never of any other.
3. The circuit proofs rest on hand-written models, which are assumed, not proven, to match the circuits. See audits and verification.

PrivacyCopy Anchor Link

4. The indexer can link spends to identities, because a spend's request names the spender and the notes it spends.
5. Deposits are attributable. A deposit's public side can be traced to the wallet that registered.

LivenessCopy Anchor Link

6. Any one of six attesters can halt value transactions. The escape hatch is the way out meanwhile.
7. Without a forester, spending stops once the staging buffer fills.
8. Encrypted notes live off chain. A note whose encrypted copy is lost cannot be found or spent by its recipient.
9. Expired notes cannot be spent by any path.

RelatedCopy Anchor Link